How Alert Fatigue Impacts Cybersecurity

Abstract

Alert fatigue is a common phrase in the world of cybersecurity. Between the blaring alarms and feeling of being overwhelmed an inadvertent psychological response is caused that desensitizes individuals. It becomes difficult to distinguish between legitimate and false alerts, while also conditioning analysts to find ways to tolerate the fatigue, normalize it, and eventually begin to ignore alerts.

In order to combat this, SOCs and CISOs need to lean into AI-Assisted Cybersecurity tools to augment their existing teams by automating decisions, reducing mundane tasks, and streamlining and enhancing the work of your SOC analysts, throughout all the phases of threat detection and negation via AI.

What is Alert Fatigue

Alert fatigue, on one hand, results in a cognitive overload due to the amount of work, the complexity of the work, and the effort between distinguishing the legitimate from the false alerts. Consequently, the more you’re exposed to something, the easier it becomes to find ways to tolerate it, normalize it, and eventually begin to ignore it. What it becomes is essentially the fable of the boy who cried wolf, brought to life, with far more unfortunate outcomes.

Cybersecurity is no different. Every day a malicious actor is looking to steal data or transfer funds via a cybersecurity intrusion. Each attempt triggers an alarm, but not every alarm is heeded.

The Effects of Alert Fatigue

This leads to a lot of risks being taken by Security Operations Center (SOC) analysts worldwide. When false positives are a key part of their daily routines, it becomes difficult to handle all the alerts and give attention to the ones that are critical. Ideally, every alert is investigated to see if it’s genuine, but in actuality, there isn’t enough time, resources, or employees to investigate them all. This leads to missed or ignored alerts. In SecOps this can lead to more incidents that lead to breaches, hacks, and other major incidents. This not only impacts the data that they are entrusted with protecting, but also leads to consequences in revenue, costs, and their brand reputation.

There is also the danger of slow response times. An alarm doesn’t need to be missed or ignored to become a critical issue; it can also be temporarily ignored. If the previous alerts have been false, will an analyst give their attention immediately to the next? Probably not, and it’s not the fault of the analyst themselves. They’re tired and burnt out.

According to Forrester Research:

A single day shows that, on average, a SOC team will receive 11,000 alerts per day.
18% of those manually reviewed
32% are false positive
28% are ignored
17% are touched by automation
Nearly 50% of SOC managers admit that their staff cannot manage to investigate every alert.

These are some troubling numbers. It gets more critical when the company size increases. In a company with 20K+ employees, for example, the number of ignored alerts rises to 36%. The more entry points, and points for human error, increases the security risk exponentially.

The Cybersecurity Impact

There is no doubt that cybercrime is on the rise. On a daily basis, new intrusions and hacks are discovered, requiring constant vigilance. Also, the move towards digitization as a result of new technologies and the pandemic has led to new modalities of remote work and thus more endpoints.

With more points of access, an additional layer of security measures need to be implemented that will generate more alerts. Any security system (human or otherwise) implemented by an organization must be capable of identifying all the different variations of a hack, and all of the early signs of an impending attack to prevent a potential breach.

If the alerts are missed, or dealt with too late, devastating cyberattacks such as the 2017 Equifax data breach or Target’s 2013 data breach. Both of these had clear indications and alerts that were ignored, missed, or dismissed.

The reality, however, is that in order to avoid the impact of alert fatigue on an organization’s security, they need to offer SOC analysts on the front lines additional support. According to IBM’s X-Force Threat Intelligence Index, attacks that resulted in data theft rose 160% between 2019 and 2020, while unauthorized server access rose by 233% during that same period. It’s evident that malicious actors are succeeding, and SOCs need assistance.

For example, low-fidelity alerts are common alarm notifications that are ignored. This means that a system may over-alert on an event that has a low potential to be malicious, such as a poorly curated “known-bad IP address” list that actually has benign addresses, or when a legitimate action releases an indicator that is misleading without context. Examples could include an employee entering their password wrong 3x, or an older browser visiting the website. Depending on the sensitivity of your security software and the capabilities of the SOC team, an alert is issued. Somewhere between these innocent queries are hidden the dangerous ones, and they’re missed.

The unprecedented amount of alerts, the lack of staff, and the overwhelming burnout is the reason that 42% of SOC teams have reported that their alert volume has increased since the pandemic, and is 200% higher than it was in 2015. Even more concerning is the issue that 31.9% of IT security professionals ignore alerts because so many of them, nearly 2/3rds, were previously false alarms, according to Cloud Survey Alliance. To put that in perspective, a similar study found 300 U.S.-based IT analysts at companies with 500 or more employees, spend an average of 30 min to clear every actionable alert, and lose 32 min chasing down false leads.

This is why many organizations are moving towards automated systems to collect, manage, and sort data from various sources to help identify suspicious activity. While it adds an element of automation to the process to hopefully alleviate some of the burdens on existing IT security staff, there is also the potential for an increase in alerts, if the software isn’t deployed and managed appropriately. This outcome requires that enough resources are allocated to analyze and manage alerts, as well as deploy swift response solutions.

Instead of the security burden falling on employees to balance security with other tasks, as well as manage alert fatigue effectively, a team needs to be able to rely on their SOAR (Security Orchestration, Automation, Response) tool for security. But, even these tools rely on static rules which aren’t very scalable and need to be adjusted periodically. They also require hard-to-source and expensive experts to operate and maintain. This tool can only do what it’s programmed to do.

On the other hand, there are tools such as smart detection that can lead to more alerts. The problem is that as detection gets better the number of alerts increases because there is another source of alerts.

The alternative is an AI model; AI-Assisted Cybersecurity, in fact. A tool that can leverage the collective knowledge of security expertise you already have and assist with investigating threats, managing them, then stopping them. Relying on AI will help you scale your security processes.

Cybersecurity and AI-Assisted Cybersecurity

AI-Assisted Cybersecurity is a unique approach that promises to streamline security operations and reduce repetitive actions.

This is a hybrid approach where the AI works with a SOC team to create efficiency in security operations by embedding expert knowledge and historical data into AI models that are then validated by analysts. Via deep learning, decision automation, and expert knowledge, AI-Assisted Cybersecurity scales the cybersecurity department’s capacity to handle and address threats by leveraging collective knowledge to assist with decision-making, reducing noise, and alleviating the workload of cybersecurity analysts by automating decisions and post-decision manual tasks.

At its onset, an AI-Assisted Cybersecurity such as Arcanna.ai is process-based yet capable of learning. Think of this platform as a kind of “driver’s assist.” AI-Assisted Cybersecurity continuously learns from the existing cybersecurity experts and scales the team’s capacity to deal with threats by augmenting the decision-making process.

How AI Assists with Cybersecurity

In order to offer efficiency to the SOC, an AI-Assisted Cybersecurity platform relies on:

Deep Learning and Assistance

The collective knowledge of the most experienced analysts of the SOC team is aggregated in AI-Assisted Cybersecurity. Not only is the tool capable of assisting based on the experiences of your non-AI teams, but the tool can also learn as it goes. An AI-Assisted Cybersecurity relies not only on historical data and team behavior to manage alerts but is also augmented with context through analyst feedback. Thus, the tool offers a deeper skillset to your team of experts.

Assisted Decision Making.

At the Decision Stage, based upon the data available and knowledge embedded into the model to AI-Assisted Cybersecurity, the model makes an automated decision to either “escalate” or “drop” an alert. This is presented to analysts and drastically reduces the number of false alerts that SOC analysts chase down and allows for attention to be given to legitimate breaches and cybersecurity concerns.

Retains Knowledge and Experience

Since the AI-Assisted Cybersecurity represents all of the experts who have provided input to the AI model this will not only benefit the existing team, but also future analysts and the entire SOC team. This offers a safety net for new analysts and keeps critical business intelligence in-house. As well, it helps with staff turnover, promotions, as well as role changes to allow talented analysts to grow and advance within the organization.

The AI is Adaptable and Customizable

The model has two advantageous ways in which it can be customized.

First, a feature selection exists to address specific organizational needs or threat categories while also integrating seamlessly within any cybersecurity ecosystem.

The second is that an AI-Assisted Cybersecurity such as Arcanna.ai can adapt to the particularities of the ecosystem in which it runs based on the context it gets.

Takes Care of Post-Decision Manual Tasks

The AI-Assisted Cybersecurity can also reduce manual work such as case and ticket creation by working in tandem with the SOAR playbook. This means that time-consuming tasks can be taken away from analysts and automated.

Easy to Use Via The No-Code Model

Designed to be simple to implement and intuitive. Installation, integration, and the use of the platform don’t require any specialized knowledge, outside of what a traditional SOC team already has. Any analyst with security knowledge can benefit from - and contribute to - the model.

Offers Scalability

Regardless of organization size, your tools and systems need to be scalable. The AI-Assisted Cybersecurity harnesses the collective expertise of the entire SecOps team and continues to add additional efficiencies into your cybersecurity processes as you grow. Not only is it a valuable asset to the IT team, but offers efficiency and productivity to your human resources team and boosts their ability to focus on company growth.

The Model is System Agnostic

Your internal infrastructure and existing cybersecurity tools will not be a hindrance when implementing an AI-Assisted Cybersecurity. The tool is completely system agnostic. It does not replace or change already existing processes/tools but enhances them by automating the decision and post-decision processes using AI

As a result, the weight of responding, potentially missing, and mishandling alerts is negated.

The AI-Assisted Cybersecurity tool streamlines and enhances the work of your SOC analysts, throughout all the phases of threat detection and negation. The model triages your alerts and reduces the time spent on false positives to help analysts focus on the real threats. Along the way, the model continues to adapt and learn and offers new opportunities to enhance your security parameters.

Most importantly an AI-Assisted Cybersecurity such as Arcanna.ai offers a future-proof, efficient, and scalable solution to alert fatigue for the cyber security industry.